8

I want to protect my computer from fake USB keyboards like the USB rubber ducky .

But I don't know if it will lock the screen before USB Rubber Ducky starts working. I don't want to buy a rubber ducky to check this.

How can I further test the keyboard detector, if I don't have access to the USB Rubber Ducky myself?

3

6 Answers 6

6

If the user account you are using is not in the Administrator group, it will make it harder for a Rubber Ducky to operate. The weakness of the Rubber Ducky is running pre created scripts (payloads), and most of them are meant to accounts that like most Windows PCs are in the Administrator group. In a limited account, you will need to enter the Administrator credentials to do certain actions (i.e. change a Registry value) or run certain programs and without these credentials, the Rubber Ducky won’t be able to proceed.

3

If Penteract's software performed the required action when a keyboard USB was plugged in, it is a fair assumption that it would block a rubber ducky as well (they are both HIDS).

The more traditional defense against a rubber ducky includes limiting access to powershell, the cmd prompt, and the run command as these are the most common ways a rubber ducky executes malicious code.

1
  • But will it be fast enough to lock before the rubber ducky starts working?
    – 123
    Nov 20, 2017 at 16:56
3

If your policies do not permit users to bring in their own peripherals, you may want to consider using Product ID & Vendor ID whitelisting software. Remember, that this will cause the system to effectively disable ANY non whitelisted device, including those that may be built in, like webcams and smartcard readers.

Otherwise, consider creating a GPO that requires password input for all UAC prompts, as that will effectively limit any keyboard emulator to nonprivileged access, and will not prevent assistive devices (like some OTP keys used by blind users, that emulate a keyboard and type the token code.)

This is one of the harder vectors to defend against, because the computer typically trusts that the input given by the user is based on the users intentions.

6
  • 1
    Another option is to block all USB keywords if there is already one present.
    – Anders
    Feb 20, 2018 at 18:29
  • 1
    PID/VID whitelisting is worthless against malicious USB devices unless your legitimate keyboard/mouse are PS/2 or something, since the malicious device could just use the same PID/VID as the legitimate device (which isn't hard to figure out) otherwise. Feb 21, 2020 at 3:20
  • @Anders So now the bad guy just has to unplug your real keyboard before plugging in the rubber ducky. Feb 21, 2020 at 3:21
  • @JosephSible-ReinstateMonica The strength of a rubber ducky is that you can plug it in while the victim is watching - you can even get the victim to do it for you: "Could you print this for me?" The victim will probably get suspicious if you pull out the keyboard cable... In the scenario that you have access to the target computer alone, there is no need to obfuscate a keyboard as a USB-stick.
    – Anders
    Feb 21, 2020 at 7:59
  • @Anders While PID/VID whitelisting won't stop a more sophisticated attack, it dies raise the bar, in that they need to determine the VID/PID of an allowed device, which requires nonzero effort. Especially because some devices can look identical, and have different identifiers (dell keyboards are one of them). There are a few other complications, but if you have a small number of users who need a higher level of protection, consider a "high-integrity" laptop with usb ports disabled in BIOS, or physically disabled.
    – Laikulo
    Mar 24, 2020 at 20:04
0

This may not be a great alternative but if you have a spare device android device that meet Kali nethunters requirements you could root and install that.

This will let you perform HID keyboard and BadUSB attacks. Again might not be ideal as it requires rooting a device - but it should also be a consideration if you are trying to mitigate these sorts of attacks.

0

I've developed a C# Service that runs in background that lockouts the computer at USB introduction that not matches a whitelist. It has also a training mode that will add USB devices signatures while setted. Any recommendation and improvement is appreciated.

https://github.com/JBalanza/USBBlocker

0

This Answer is aiming on how to stop the rubber ducky:

If you use Ubuntu, the approach presented in this video steming from this guide should work for you:

  1. open a terminal
  2. run the following command in the terminal:

sudo echo 'blacklist usbhid' > /etc/modprobe.d/usbhid.conf

  1. run the following command in the terminal:

sudo update-initramfs -u -k $(uname -r)

  1. reboot the computer

Sadly this method has the side effect that USB mouses and keyboards wont work anymore, as explained in both the video and the guide, because it works by configuring the OS to not accept mouse/keyboard input from devices connected via USB.

However, this way of treating the issue also has its pros, because since the OS then discards USB mouse/keyboard input, there is no way any rubber ducky may get around it, its 100% sure that this method will stop this specific type (rubber ducky emulating keystrokes and/or mouse interaction to run commands) of attack (you dont have to worry about some shady protective program acting quick enough) and since no extra programs are required, you dont risk to infect your OS by installing poisoned ones.

If you use other Linux operating systems, you may be able to use similar blacklisting mechanisms in a similar fashion.

If you use Windows, I dont know, but I think youre screwed. I hardly doubt that windows provides similar mechanisms, afaik you can't even disable atomatic USB mounting on windows. But I would not do things where security is paramount on a windows machine anyways, since these are in general far more vulnerable (if the gossip got it right).

Disclaimer: as I am absolutely new to this topic (hardening devices) and do not fully understand the solution presented in the video and the guide, I cannot guarantee for anything, I just present that solution here, along with some assumptions of mine. However, since everything seems perfectly sound to me, I hardly doubt I got something wrong, please correct me tho if I did.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.